Dual-View Time-Series-Imaging-Driven Anomaly Detection for Industrial Control Systems

Abstract

Time-series anomaly detection (TSAD) is critical to guarantee the security of industrial control systems (ICS). However, harsh operating conditions and complex control commands may give rise to multiple intertwined feature patterns in ICS sensor signals, which are further compressed into compact 1D time-series data. Most existing methods directly identify anomalous behaviors in the original 1D space, which always leads to complex model structures and limited detection performance. To solve this issue, this paper proposes a dual-view time-series-imaging-driven model, namely 2DTSAD, for unsupervised timestamp-wise anomaly detection in ICS. Firstly, the local–global pattern discrepancy is designed as a heuristic principle for timestamp-wise anomaly identification. Secondly, a customized time-series imaging scheme is developed to transform 1D sensor signals into timestamp-wise local and global 2D pattern images from context and association views. Thirdly, a dual-view coupled contrastive learning network is constructed by integrating customized large-kernel convolutions and bidirectional feature extraction to capture discriminative local–global discrepancies. Finally, a robust anomaly scoring strategy is designed to aggregate local–global discrepancies across variables to generate final timestamp-wise anomaly scores. Extensive experiments demonstrate that 2DTSAD outperforms multiple state-of-the-art(SOTA) models. The source code of 2DTSAD is publicly available at https://github.com/infogroup502/2DTSAD Note to Practitioners—This paper is motivated by a practical challenge in industrial control systems: anomalous features are difficult to accurately identify from multiple complex and intertwined patterns that are compressed into a compact 1D signal space. Existing approaches mainly detect anomalies directly in the original 1D space by models with complex structures or large parameters, while their detection accuracy, timeliness and practical applicability remain limited in complex industrial scenarios. Thus, this paper explores a new way that combines time-series imaging and multi-view learning to realize unsupervised timestamp-wise anomaly detection for the ICS. (1) It firstly designs a customized local–global pattern discrepancy for timestamp-wise anomaly identification. (2) Based on the proposed anomaly identification mechanism, this paper develops customized time-series imaging and dual-view feature extraction strategies for discriminative anomaly representation. (3) It considers dual-view local–global discrepancies across multiple variables for robust timestamp-wise anomaly detection. Accuracy comparisons and ablation studies verify that the proposed model outperforms existing SOTA methods. Timeliness, resource consumption, and case-study experiments further demonstrate its applicability in real-world industrial environments.